Repository navigation
Range inference optimizer bug #24088
Description
Description
The following code:
<?php
function f($x) {
if ($x > 5 && $x < 7) {
return match ((int) $x) { 6 => "six", default => "not six" };
}
}
echo f(5.5);Resulted in this output:
six // under opcache/optimizations
not six // without
Obviously "not six" is the right answer.
The problem can be seen in range inference:
#3.CV0($x) [any] RANGE[6..++] = Pi(#1.CV0($x) & RANGE[6 .. ++]) // $x > 5
#5.CV0($x) [any] RANGE[6..6] = Pi(#3.CV0($x) & RANGE[-- .. 6]) // $x < 7
#6.T3 [long] RANGE[6..6] = CAST (long) #5.CV0($x) [any] RANGE[6..6]
So each comparisons narrows the range, but (int)5.5 equals 5. Then SCCP performs folding and we end up with the wrong result. The problem is that the range inference is only valid on int inputs.
I'm unsure how to fix this. We could track whether the range is definitely for an int, but that's painful.
PHP Version
8.4+
Operating System
No response
Reacted by Weilin Du and Michael Voříšek
Activity
LamentXU123 commentedon Oct 3, 2026
Here is an related case I stumbled across I find intresting
With Opcache open it returns six. Which it shouldn't.
ext/opcache: Fix phpGH-24088 integer range propagation
ext/opcache: Fix phpGH-24088 integer range propagation
ndossche commentedon Nov 8, 2026
JIT fuzzer ran into a variant: https://issues.oss-fuzz.com/issues/579025375